Magebean Logo Magebean
← Back to Baseline

MB-0812

Partially automated REST ACL references are declared in collected context

MB-C20 Module Integrity & Compatibility Medium

In development, selected modules’ global webapi.xml resource references resolve to collected static global ACL declarations or anonymous/self; activation is not established. Other profiles assess selected enabled modules against enabled ACL declarations.

Overview

Match each global REST resource reference to the collected ACL declarations. Development inspects static source; other profiles require enabled module context. Anonymous/self are special declarations, not proof of appropriate access.

Why it Matters

An unresolved ACL resource can prevent the intended REST access policy from being configured.

Interpret the reported resource and collection scope before making changes. Unsupported source, unresolved symbols and bounded collection gaps cannot establish a clean result.

Verification Steps

Manual Verification

  1. Match each global REST resource reference to the collected ACL declarations. Development inspects static source; other profiles require enabled module context. Anonymous/self are special declarations, not proof of appropriate access.
  2. Inspect the reported file, declaration, package or evidence record in the same selected release. Keep source observations separate from effective runtime behavior.
  3. Apply the rule-specific remediation below, validate the affected behavior in staging, and rerun the same selection.

Command / Review Sample

php magebean.phar audit --path=/var/www/magento --profile=module-integrity --rules=MB-0812 --modules=Vendor_Module

Use the assessed Magento project and the appropriate application or read-only review account. Replace example hosts, paths and identifiers with the assessment scope; configuration and source fragments are illustrative.

Remediation / Fix Guidance

  1. Correct the reference or verify which enabled module supplies it.
  2. Verify the corrected behavior in an authorized staging environment.
  3. Rerun MB-0812 with the same module selection.

Examples

Illustrative declaration/review examples, not recorded scan output. A pass example concerns only the stated predicate and supported collected scope.

Fail Example

REST resource: Vendor_Module::read
No such resource in the complete applicable ACL context.

Pass Example

REST resource: Vendor_Module::read
Applicable collected ACL declares Vendor_Module::read.
This does not establish permission assignment or enforcement.

Scope and Evidence Limits

Rule revision: 2. Target modes: LOCAL.

In development, selected modules’ global webapi.xml resource references resolve to collected static global ACL declarations or anonymous/self; activation is not established. Other profiles assess selected enabled modules against enabled ACL declarations.

Missing references are suspected because runtime and generated ACL additions can affect the tree.

Catalog coverage describes implementation capability, not a scan outcome. An incomplete manual review cannot establish that the criterion is satisfied.

References